REMARKS 



Claims 1 and 3-23 are pending in the application. Claim 2 has been 
canceled without prejudice or disclaimer. Claim 23 is newly added. 
Reconsideration of this application is respectfully requested. 

The Office Action rejects claims 1-22 under the second paragraph of 35 
U.S.C. 1 12 as indefinite because the term "certificate" as used in the claims is 
not clearly defined in the specification. This rejection is moot as to claim 2, which 
has been canceled. 

This rejection is respectfully traversed. First, the rejection refers to 
"certificate", but independent claims 1, 12-14, 21 and 22 as originally filed and as 
currently amended recite a "virus-free certificate". A virus-free certificate is 
clearly described at pages 7-9 and 12-15 of the specification. For example, at 
page 9 the method of the present invention is described as "using Certificates 
similar to X.509 Certificates used to authenticate an identity. A specific process 
associates a Certificate with a file to speed up and improve the anti-virus 
processing." Also, at page 9, it is noted that a file is validated against all known 
viruses by adding a virus-free Certificate to the file. 

At page 12, the virus-free certificate is described as being stored in a file 
server 101 and as being provided by a Virus-Free Certificate Authority Server 
102 after request by the file server 101 . Fig. 2 discloses the contents of the 
virus-free certificate and pages 13-15 clearly describe the fields that contain the 
contents. It is submitted that the term, "virus-free certificate" is clearly described 
in the specification to enable one skilled in the art to practice and use the 
invention. Moreover, the description contained in the specification clearly 
describes a "virus-free Certificate" as being issued by a Virus-Free Certificate 
Authority. Field 1 08 describes the anti-virus programs used by the Certificate 
Authority to verify that a file is virus-free. 
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The term, "virus-free certificate" in independent claims 1, 12-14, 21 and 22 
is clearly definite in view of the description provided in the specification and, 
therefore, fully compliant with the second paragraph of 35 U.S.C. 1 1 2. 

The Examiner's reference to an applicant acting as his own lexicographer 
is taken as a helpful explanation, but is not deemed relevant to the issue of 
indefiniteness that is the basis of the rejection. Moreover, the referenced case of 
Process Control Corp. v. HydReclaim Corp., 190 F3d 1350, 1357, 52 USPQ2d 
1029, 1033 (Fed. Cir. 1999) concerns a claim construction issue, with the Court 
ruling in favor of a claim construction that was consistent with specification. The 
Court's reference at page 1 033 to a patentee acting as his own lexicographer is 
not relied upon by the Court for its ruling, and, therefore, is dicta, which has no 
bearing on a patentee or an applicant being his own lexicographer. 

The referenced section 2106 of the MPEP requires the Examiner to rely 
on the Applicant's disclosure to properly determine the meaning of terms used in 
the claims. The Examiner has not alleged that Applicants have made arguments 
that are inconsistent with the description in the specification. In view of the 
above discussion, it is clear that the term, "virus-free certificate", in independent 
claims 1, 12-14, 21 and 22 is clearly described in the specification. 

For the reasons set forth above, it is submitted that the rejection of claims 
1 and 3-22 under the second paragraph of 35 U.S.C. 112 is erroneous and 
should be withdrawn. 

The Office Action rejects claims 1, 3, 4, 7, 9, 11-18, 21 and 22 under 35 
U.S.C 103(a) as unpatentable over U.S. Patent No. 6,154,844 to Touboul et al., 
hereafter Touboul in view of U.S Patent No. 6,094,731 to Waldin et al., hereafter 
Waldin. 
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This rejection is respectfully traversed for the reasons set forth below. 



Touboul generates a Downloadable Security Profile (DSP). A DSP 
includes a list comprising all potentially hostile or suspicious computer operations 
that may be attempted by a Downloadable (column 4, lines 4 to 6). Therefore, a 
DSP is a warning object that lists all potential hostile or suspicious operations or 
patterns. The anti-virus certificate according to the present invention is like an 
empty DSP identifying nothing suspicious in the file. However, such DSP does 
not give any indication concerning the way the file has been tested (the anti-virus 
programs that have been executed on the file). A DSP only identifies that a file 
may attempt the listed hostile or suspicious computer operations. 

The DSP object described in Touboul is different from the anti-virus 
certificate according to the present invention. The anti-virus certificate doesn't 
list potential viruses. If one anti-virus program detects a virus, no anti-virus 
certificate is generated. The anti-virus certificate doesn't list all potential viruses 
but only lists the anti-virus programs that have been used (with the program level 
and the date). The anti-virus certificate guarantees that no virus has been 
detected by the listed anti-virus programs. In contrast, Touboul's DSP lists 
hostile or suspicious computer operations, but does not list anti-virus programs. 

So the object of the DSP and the object of the anti-virus certificate of the 
present invention are quite different. The content of the DSP and the content of 
the anti-virus certificate are also completely different. In fact, the object of the 
DSP is for users, to perform additional tests on suspicious identified items. The 
purpose of the present invention is to do nothing more than 
verifying/authenticating the anti-virus certificate. The object of the present 
invention is not to execute other verification programs such as local anti-virus 
programs. It is easy to see that the object of Touboul and the object of the 
present invention are completely opposed. 
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In Touboul, a certificate is generated to verify the authenticity of the 
attached DSP (column 5, lines 53-55). The DSP is not a certificate by itself. The 
anti-virus certificate according to the present invention verifies 
the authenticity of the file (signature), 
the authenticity of the certificate ), and 
that the file has been effectively tested by a trusted entity 
(certificate authority) with the listed anti-virus program(s). 
The DSP is not a so-called "standard X.509 digital certificate" and the certificate 
in Touboul is not associated with the file but to the DSP. 

To summarize, Touboul uses at least four objects: the file, the DSP, the 
downloadable ID and the inspector certificate. The downloadable ID is outside 
the DSP and outside the certificate. In the present invention, there are only two 
objects: the file and the anti-virus certificate. 

The combination of Touboul and Waldin lacks several elements or steps 
of independent claims 1, 12-14, 21 and 22. 

Touboul/Waldin lacks the step/element of receiving a request for a virus- 
free certificate that comprises the file for which the virus-free certificate is 
requested recited in independent claims 1,12 and 13. 

" Touboul lacks receiving a request for a virus-free certificate. Touboul 
merely downloads a downloadable from a web server 185. The downloadable 
comprises a downloadable file 150 and a DSP (Downloadable Security Profile). 
The DSP simply contains a list of all potentially hostile or suspicious computer 
operations that may be attempted by the downloadable file. There is no request 
for virus-free certificate. There is just the action by computer client 130, namely, 
downloading from web server 185 the downloadable file with the DSP attachment 
previously posted to web server 185 by developer 120 and inspector 125. 
Therefore, Touboul does not request a virus-free certificate. 
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Waldin does not request a virus-free certificate. Waldin's recipient 
computer 1 1 merely receives file 1 with file 4 attached from originating computer 
2. There is no virus-free certificate request that is received by recipient computer 
1 1 for file 1 . Recipient computer 1 1 examines file 4 and determines if file 1 has 
changed since originating computer 2 did a virus scan. If so recipient computer 
1 1 then does a virus scan. However, there is no request for a virus-free 
certificate received by recipient computer 1 1 with file 1 . Therefore, 
Touboul/Waldin lacks the receiving step/element of independent claims 1,12 and 
13. 

Touboul/Waldin lacks the step/element of "if the file is declared virus-free 
by the virus-free certificate authority: generating a virus-free certificate 
comprising a file signature for certifying that said file is declared virus-free by the 
virus-free certificate authority", as recited in independent claims 1, 12 and 13. 

The Examiner admits that "Touboul does not disclose a virus-free 
certificate and certifying that a file is virus free". The Examiner contends that 
Waldin "discloses certifying that a file is virus-free (column 6, lines 10-15)". 
However, Touboul/Waldin does not generate "a virus-free certificate" as recited 
by independent claims 1,12 and 13. 

The virus-free certificate created by the present invention is a secure 
structure that contains information that can be used by any system to trust the file 
without having to run again an anti-virus program. This is in contrast to Touboul 
and Waldin who teach to run an anti-virus program on a file that is received or 
downloaded. 

The Examiner admits that Touboul lacks a virus-free certificate request 
and generating a virus-free certificate comprising a file signature for certifying 
that the file is declared virus-free by the virus-free certificate authority. Waldin 
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merely states that "the entire contents of file 1 have to be re-examined for 
viruses, as the contents of file 1 cannot in that case be certified as virus-free". 
There is no mention of "generating a virus-free certificate". 

In addition, Touboul/Waldin lacks a virus-free certificate authority as 
recited in independent claims 1,12 and 13. 

Neither Touboul nor Waldin mentions a "virus-free certificate authority". 
Therefore, Touboul/Waldin lacks a virus-free certificate authority as recited in 
independent claims 1, 12 and 13. 

For all of the above reasons, Touboul/Waldin lacks the step/element of "if 
the file is declared virus-free by the virus-free certificate authority: generating a 
virus-free certificate comprising a file signature for certifying that said file is 
declared virus-free by the virus-free certificate authority", as recited in 
independent claims 1,12 and 13. 

Touboul/Waldin lacks "sending back in response to the virus-free 
certificate request the file with the integrated virus-free certificate", as recited in 
independent claims 1, 12 and 13. 

Since Touboul/Waldin lacks receiving a virus-free certificate request, it 
also lacks sending back in response to the virus-free certificate request the file. 
Also, since Touboul/Waldin does not generate "a virus-free certificate" it cannot 
send back the file with the integrated virus free certificate. 

Moreover, Waldin at column 6, lines 46-48, merely states that if recipient 
computer 1 1 "certifies file 1 as being free of viruses, the steps illustrated in Fig. 4 
should be repeated by originating computer 2". That is, files 1 and 4 are not sent 
back to originating computer 2. 
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For the reasons set forth above, Touboul/Waldin lacks "sending back in 
response to the virus-free certificate request the file with the integrated virus-free 
certificate", as recited in independent claims 1,12 and 13. 

Touboul/Waldin lacks "a virus-free certificate" and "a virus-free certificate 
authority" as recited in independent claims 14, 21 and 22 for the same reasons 
set forth in the discussion of independent claims 1, 12 and 13 above. 

Touboul/Waldin lacks "a virus-free certificate" and "a virus-free certificate 
authority" as recited in independent claims 14, 21 and 22 for the same reasons 
set forth in the discussion of independent claims 1, 12 and 13 above. Therefore, 
Touboul/Waldin lacks each of the steps/elements recited in independent claims 
14, 21 and 22. 

In addition.Touboul/Waldin lacks "authenticating the virus-free certificate" 
and "authenticating the file", as recited in independent claims 14, 21 and 22. 

Neither Touboul nor Waldin discloses or teaches authenticating a virus- 
free certificate or a file. Therefore, Touboul/Waldin lacks "authenticating the 
virus-free certificate" and "authenticating the file", as recited in independent 
claims 14, 21 and 22. 

The Office Action suggestion to use Waldin in combination with Touboul is 
improperly based on the hindsight of Applicants' disclosure. Such hindsight 
reconstruction of the art cannot be the basis of a rejection under 35 U.S.C. 103. 
The prior art itself must suggest that modification or provide the reason or 
motivation for making such modification. In re Laskowski . 871 F.2d 115, 117, 10 
USPQ 2d 1397, 1398-1399 (CAFC, 1989). "The invention must be viewed not 
after the blueprint has been drawn by the inventor, but as it would have been 
perceived in the state of the art that existed at the time the invention was made." 
Sensonics Inc. v. Aerosonic Corp . 38 USPQ 2d 1551, 1554 (CAFC, 1996), citing 



16 



Interconnect Planning Corp. v. FeiL 774 F. 2d 1132, 1138, 227 USPQ 543, 547 
(CAFC, 1985). 

For the reasons set forth above, it is submitted that the rejection of claims 
1, 3, 4, 7, 9, 11-18, 21 and 22 under 35 U.S.C. 103(a) is erroneous and should 
be withdrawn. 

The Office Action rejects claims 2, 5, 6, 8, 19 and 20 under 35 U.S.C 
103(a) as unpatentable over Touboul in view of Waldin as applied above and 
further in view of U.S. Patent No. 6,275,937 to Hailpern et al., hereafter Hailpern. 
This rejection is moot as to claim 2, which has been canceled. 

This rejection is traversed for the same reasons set forth above in the 
discussion of independent claims 1 and 12-14 upon which claims 5, 6, 8, 19 and 
20 depend. 

This rejection is also traversed for the same reasons set forth in the 
discussion of the rejection thereof in the Amendment filed on July 15, 2004, 
which discussion is incorporated herein by reference. 

For the reasons set forth above, it is submitted that the rejection of claims 
5, 6, 8, 19 and 20 under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action rejects claim 10 under 35 U.S.C 103(a) as unpatentable 
over Touboul in view of Waldin as applied above and further in view of U.S. 
Patent Publication No. 200301 10376 A1 to Weiner et al., hereafter Weiner. 

This rejection is traversed for the same reasons set forth above in the 
discussion of independent claim 1 upon which claim 10 depends. 
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This rejection is also traversed for the same reasons set forth in the 
discussion of the rejection thereof in the Amendment filed on July 1 5, 2004, 
which discussion is incorporated herein by reference. 



For the reasons set forth above, it is submitted that the rejection of claim 
10 under 35 U.S.C. 103(a) is erroneous and should be withdrawn. 

The Office Action cites a number of patents that were not applied in the 
rejections of the claims. These patents have been reviewed, but are believed to 
be inapplicable to the claims. 

New claim 23 is a rewrite of claim 1 with the subject matter of claim 2 
incorporated therein. New claim 23 is allowable for the same reasons set forth 
above for the discussion of claim 1 and the discussion of claims 5, 6, 8, 19 and 
20. 

It is respectfully requested for the reasons set forth above that the 
rejections under 35 U.S.C. 112, and 35 U.S.C. 103(a) be withdrawn, that claims 
1 and 3-23 be allowed and that this application be passed to issue. 



Respectfully Submitted 



Date: 





Paul D. Greeley 
Reg. No. 31,019 
Attorney for Applicants 
Ohlandt, Greeley, Ruggiero & Perle, L.L.P. 
One Landmark Square, 10 th Floor 
Stamford, CT 06901-2682 
(203) 327-4500 
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